Virus problems

The_KiD · 5 May 2006 at 16:01

Delete it in safe mode and re-install flight sim if you still play it

webmonkeyuk · 5 May 2006 at 16:04

found another in lock on that couldnt be fixed, all the ones that dont get fixed delete in safe mode?

div0 · 5 May 2006 at 16:12

might be best to post what they are - just to check.....

it sounds like a particularly nasty virus you got there!!

anything on that disk that is important to you and not backed up?

webmonkeyuk · 5 May 2006 at 16:16

not really, i do have a second hd running too and i use that as my backup disk but that has been infected too. nothing really of importance on it just all my stuff for Fs2004 and other downloads

webmonkeyuk · 5 May 2006 at 16:21

ok the 2 that couldnt be fixed were Lockon\register_exe.vir
flight one software\ultimate traffic\ultimate traffic_exe.vir

div0 · 5 May 2006 at 16:24

more (ex) game related files?

if so - just delete in safe mode....

div0 · 5 May 2006 at 16:24

go for it!

HighlandeR · 5 May 2006 at 17:38

quit all the messing and backup your my docs and format and Reload WinXP !

Then put on a decent firewall/AV and update those sigs and full winXP update...

And in future use Acronis Backup or Norton ghost utlity

Cueball · 5 May 2006 at 19:54

KasperSky Anti-Virus - the mutts nutts.

The_KiD · 6 May 2006 at 09:28

Woah ignore the advice to do a windows restore, this will merely put you to a point where you had the virus again and it wont get rid of the infectec files either.

The files that it is finding that end in .vir have already being fixed. .vir is what some antivirus progs to stop you running the file again. so just delete them.

How is the system working now?

The_KiD · 6 May 2006 at 17:22

ANy news webmonkey?

webmonkeyuk · 7 May 2006 at 19:01

all working fine now guys thanx for the help, that stinger worked a treat

would have answered quicker but i got suspended for saying a bad word :eek:

Thanx again guys you saved me a reinstall

div0 · 7 May 2006 at 21:19

webmonkeyuk said:
all working fine now guys thanx for the help, that stinger worked a treat

good stuff

webmonkeyuk said:
would have answered quicker but i got suspended for saying a bad word

lol - tut tut

HighlandeR · 7 May 2006 at 22:40

The_KiD said:
Woah ignore the advice to do a windows restore, this will merely put you to a point where you had the virus again and it wont get rid of the infectec files either.

The files that it is finding that end in .vir have already being fixed. .vir is what some antivirus progs to stop you running the file again. so just delete them.

How is the system working now?

Yeah re-edited I meant Restore as in Reload windows XP...

best and only 100% soloution when dealing with viruses/spyware that wont go away

I know I do it daily for a living, been having a headache over smitfruad variants for this past week

Curio · 8 May 2006 at 05:25

Whoa, this Polipos is a nasty virus - it just took down the wife's PC big style :eek:

Pretty much every single exe file is infected (that's how it travels). The Stinger has got rid of a lot of it, but some exe's (including Explorer) are totally wrecked. Gonna go for a complete reformat and re-install as it was due for one anyway.

Fortunately, it didn't infect any of the other PC's in our little network. Phew.

webmonkeyuk · 8 May 2006 at 09:18

just a quick question, any idea how it could have got on my pc ive got a firewall in the router (Belkin one) and ive got windows firewall on too the AVG is always upto date too

The_KiD · 8 May 2006 at 11:43

webmonkeyuk said:
just a quick question, any idea how it could have got on my pc ive got a firewall in the router (Belkin one) and ive got windows firewall on too the AVG is always upto date too

When W32.Polip is installed, it performs the following actions:

1. Infects .scr and .exe files when they are opened or executed on the compromised computer.

2. Hides its presence on the compromised computer by injecting its code into running processes.

3. Attempts to spread by sharing infected files on the Gnutella file sharing network, even if the Gnutella software isn't installed on the compromised computer.

4. Tries to lower security settings by deleting certain files relating to antivirus software.

So basically it either infected you via p2p software you use or through a program or screensaver you downloaded.

webmonkeyuk · 8 May 2006 at 11:47

had sharezza on ages ago but it went a bit funny so i tried limewire but took it off a few weeks back so guess it could have been one of them. should i be ok with out them programs on now and will the windows and router firewall be ok?

The_KiD · 8 May 2006 at 11:50

Should be fine now, just keep you windows up to date and your AV up to date.

webmonkeyuk · 8 May 2006 at 11:56

will do, cheers